The Chapa Payment Gateway Plugin for WooCommerce is vulnerable to a sensitive information exposure flaw that allows an unauthenticated attacker to retrieve the merchant’s Chapa secret API key. This weakness is achieved through the 'chapa_proceed' WooCommerce API endpoint, which does not enforce authentication before returning configuration data. The vendor identified the issue as a classic data‑leak scenario (CWE‑200), meaning that privileged data can be accessed by attackers with no initial credentials.

All installations of the Chapa Payment Gateway Plugin for WooCommerce version 1.0.3 and earlier are affected. The plugin is a WordPress add‑on that integrates Chapa payment processing into WooCommerce stores; any WordPress site running the vulnerable plugin falls under the scope of this vulnerability.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% shows that, at the time of analysis, the probability of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the exposed API key grants full access to a merchant’s payment account, an attacker who succeeds could authorize payments, void transactions, or steal financial information. The likely attack vector is remote over the public internet via the exposed 'chapa_proceed' endpoint.